I've followed the docs for defining a custom attribute, called role, in AD B2C. I then followed the docs for setting up an API connector using an Azure Function that returns a hardcoded (for testing) value for the custom role attribute based on the user's email address. In the user flow I set up the custom attribute as both a "user attribute" and an "application claim" and finally set the API connector to run "before creating the user."
When I run my app and sign up with a social provider (like facebook or google), I can see in the Azure logs that the API connector is invoked correctly and my Azure Function is called, which receives the expected request json, which I extract the email address from.
The first problem I have, is during the sign up flow, the user is presented with a screen showing the custom role attribute for them to enter a value. I don't want the user to see this screen at all as a role is assigned to them. They shouldn't get to enter a role.
Anyway, just for testing, I continue on and enter some dummy text ("testing") in for the role. My Azure Function is invoked and I can see the custom role attribute is passed in the request json in the format of "extension_3h8##########################f4c_Role":"testing" where the app id (3h8### etc.) is the id of the b2c extension app.
My Azure Function then returns the expected json response like this.
{
"version":"1.0.0",
"action":"Continue",
"status":200,
"extension_3h8##########################f4c_Role":"user"
}
My user flow then completes that the user is logged in. The problem is that when I inspect the user's token I can see a "extension_Role":"testing" claim. It has the same value as what I input, not the value that was returned by my Azure Function later in the user flow. The docs state that the returned value from the API connector will be used and override anything entered by the user, but this does not appear to be the case.
Inspecting the AD B2C Audit log, shows the successful API call as part of the user flow. However there is nothing under "Modified Properties," which is where I would expect to see the custom role attribute with its old value and new value.
I've triple checked everything against the docs and am completely stuck. It appears as though this functionality just does not work as documented. Any ideas?